"A VPN performs several functions to address the security vulnerabilities of an organization. It protects user communications' privacy and indirectly provides an authentication mechanism for gateways, network devices, and authorized users. Privacy is critical to every business, its employees, and customers. This impacts what you discuss electronically and how much it is worth to someone else. Authentication is a side effect, even without IPsec. This prevents bad actors from impersonating an authorized user and gaining access to the network. It all comes down to the risk, which is proportional to the sensitivity of the information you are transmitting. The threats and vulnerabilities are out there. It is the function of the VPN to prevent them from impacting the organization's operations and reputation. It is my experience that while people may understand the value of the information they have, they may not accurately understand the risk of losing or compromising it."